diff options
| author | Manoj Prabhu B <bmanoj@codeaurora.org> | 2016-09-20 10:06:09 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-09-25 22:57:01 -0700 |
| commit | 998b7faca0c391a7279f0343bf4deb2b0419e09f (patch) | |
| tree | e6b18ff9e4378df34bfc27660a648f7cbb1b809b /drivers/char | |
| parent | 626caf4e54864d90e8d104277f9a1446e487c7e1 (diff) | |
diag: Fix possible buffer corruption by proper typecasting
This patch removes the possibilty of header length and read length
having negative values and thereby possible buffer corruption.
CRs-Fixed: 1002389
Change-Id: Id74650d5c4aaf9f84a56372f60ff5a40374e8f7b
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/diag/diagfwd_cntl.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/char/diag/diagfwd_cntl.c b/drivers/char/diag/diagfwd_cntl.c index 594d3b1bf3b5..9f43cb5427f0 100644 --- a/drivers/char/diag/diagfwd_cntl.c +++ b/drivers/char/diag/diagfwd_cntl.c @@ -651,8 +651,8 @@ static void process_build_mask_report(uint8_t *buf, uint32_t len, void diag_cntl_process_read_data(struct diagfwd_info *p_info, void *buf, int len) { - int read_len = 0; - int header_len = sizeof(struct diag_ctrl_pkt_header_t); + uint32_t read_len = 0; + uint32_t header_len = sizeof(struct diag_ctrl_pkt_header_t); uint8_t *ptr = buf; struct diag_ctrl_pkt_header_t *ctrl_pkt = NULL; |